Malicious
Malicious

eb0da1bf4db13bbb8bc8fbf752274746

PE Executable
MD5: eb0da1bf4db13bbb8bc8fbf752274746
Size: 572.42 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
572.42 KB · 572,416 B
First seen
2026-10-09 08:00 · 16 days ago
Last seen
2026-10-09 08:00 · 16 days ago
Last analysis
2026-10-09 08:00 · 16 days ago
Hashes
MD5 eb0da1bf4db13bbb8bc8fbf752274746 Sha1 f01698a5e796c1f541e82bf4ff6823f3f72f58a9 Sha256 d0f40958cc03a11ec4fcd89223c6e6a9a134284e97993eeb2940f983d164dd11 Sha384 a7f6f0aaf0d24473708ea442f3d98f4e9a9c55f7a76063aa699f5101569af99a4149ab85158ba4b256006b5fdd0345d2 Sha512 895a2b9659176806525651e4cdd56915459766e52a1b5fd34e66695985421b95f7067dd5df296eb3ab2834a78200362832d9e5ea29f4a4002dac9f4f8e7d3761 SSDeep 12288:uKeqldf5Urk0sxQ8lCoq8m7MtVmpFMcOT794:uK/X5Akh+8Qb7MtVmk TLSH E6C46B2636514E51C6851B73C19B950083E2AB86FAE3F30FB2C423A55D433FEDA4B697
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 7 files
EXEeb0da1bf4db13bbb8bc8fbf752274746
Structure
BINResources
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
BIN.Net Resources
BINWHElmCFruqIvsgO8HQ.gkDUHSYIwa4WvZZxGJ
BINt5UuFuq9yLUVGSWb4M.P9Pam8wB11kpTCsFKd
BINLciSZd8w4OpExFpUdK.Nt386YesfMjPRc3DtU
BINpboKvt1Y5kBVEmp7ec.BdUEqsNwXw2vqfbwEf
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes
Path pe:exe>bin
Shape pe:exe>bin
malicious 2 nodes
Name Value
Module Name
Yhosh.exe
Full Name
Yhosh.exe
EntryPoint
System.Void uOTpBM4yxXYeu50Yni.RdgVw2Q62Awk9I6NlA::xYHgGhh6M()
Scope Name
Yhosh.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yhosh
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void uOTpBM4yxXYeu50Yni.RdgVw2Q62Awk9I6NlA::xYHgGhh6M()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0062: nop
ret <null>
ldsfld W0G1ZDQvUtPhVK6oaMS W0G1ZDQvUtPhVK6oaMS::XGjQUxOtEs
call System.Void W0G1ZDQvUtPhVK6oaMS::AdlQy3xyPc(W0G1ZDQvUtPhVK6oaMS)
ldc.i4 0
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_b858baca58064620b10903c00102a436
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld ROwffjQt74yAKyd0Ub9 ROwffjQt74yAKyd0Ub9::Pu5Q0wfxvV
call System.Byte[] ROwffjQt74yAKyd0Ub9::AdlQy3xyPc(ROwffjQt74yAKyd0Ub9)
stloc.s V_0
ldc.i4 3
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_812fe2ae26db49ada44e0005f24feffa
brfalse IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_013B)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 1109773091
ldc.i4 1109773091
ldc.i4 1294618182
xor <null>
ldc.i4 639672373
xor <null>
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_6462a1c6104a44c8b7144e082eab931a
xor <null>
ldsfld T8OAhDQhgtK23F9SQDS T8OAhDQhgtK23F9SQDS::mfNQ3iBn1u
call System.String T8OAhDQhgtK23F9SQDS::AdlQy3xyPc(System.Int32,T8OAhDQhgtK23F9SQDS)
ldc.i4 624527817
ldc.i4 2099761168
xor <null>
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_85a85229a819430882acc4261c8afa2e
xor <null>
ldsfld T8OAhDQhgtK23F9SQDS T8OAhDQhgtK23F9SQDS::mfNQ3iBn1u
call System.String T8OAhDQhgtK23F9SQDS::AdlQy3xyPc(System.Int32,T8OAhDQhgtK23F9SQDS)
newobj System.Void CJenZtiPcBOiQyVfoO.mA2iBc9M4PFoZistOo::.ctor(System.String,System.String)
newobj System.Void UeH88kNFQrWbN3WDQQU.QReapGNwpAQyPC3uUOx::.ctor(CJenZtiPcBOiQyVfoO.mA2iBc9M4PFoZistOo)
ldloc.s V_0
ldsfld tcVw0PQxXH2cpRxQgcu tcVw0PQxXH2cpRxQgcu::Tg6QzFSl51
call System.Void tcVw0PQxXH2cpRxQgcu::AdlQy3xyPc(System.Object,System.Byte[],tcVw0PQxXH2cpRxQgcu)
ldc.i4 1
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_d194c4042e6a4343a1fb27787cb9028f
brfalse IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_013B)
leave IL_0038: ret
pop <null>
ldc.i4 5
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_f64d74a71a9042679589598546eb08b5
brtrue IL_0172: switch(IL_018E)
pop <null>
ldc.i4 0
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_016E: ldloc V_3
br IL_018E: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_e3a41eaa47b646dc9c5ebb5abd317985
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
Module Name
Yhosh.exe
Full Name
Yhosh.exe
EntryPoint
System.Void uOTpBM4yxXYeu50Yni.RdgVw2Q62Awk9I6NlA::xYHgGhh6M()
Scope Name
Yhosh.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Yhosh
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.0
Total Strings
41
Main Method
System.Void uOTpBM4yxXYeu50Yni.RdgVw2Q62Awk9I6NlA::xYHgGhh6M()
Main IL Instruction Count
96
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_1
ldc.i4 990
beq IL_0010: ldloc V_1
br IL_0062: nop
ret <null>
ldsfld W0G1ZDQvUtPhVK6oaMS W0G1ZDQvUtPhVK6oaMS::XGjQUxOtEs
call System.Void W0G1ZDQvUtPhVK6oaMS::AdlQy3xyPc(W0G1ZDQvUtPhVK6oaMS)
ldc.i4 0
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_b858baca58064620b10903c00102a436
brfalse IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
nop <null>
ldsfld ROwffjQt74yAKyd0Ub9 ROwffjQt74yAKyd0Ub9::Pu5Q0wfxvV
call System.Byte[] ROwffjQt74yAKyd0Ub9::AdlQy3xyPc(ROwffjQt74yAKyd0Ub9)
stloc.s V_0
ldc.i4 3
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_812fe2ae26db49ada44e0005f24feffa
brfalse IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 0
br IL_00A0: switch(IL_00C0,IL_013B)
br IL_009C: ldloc V_2
ldc.i4 0
stloc V_2
ldloc V_2
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_2
ldc.i4 989
beq IL_009C: ldloc V_2
br IL_00C0: ldc.i4 1109773091
ldc.i4 1109773091
ldc.i4 1294618182
xor <null>
ldc.i4 639672373
xor <null>
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_6462a1c6104a44c8b7144e082eab931a
xor <null>
ldsfld T8OAhDQhgtK23F9SQDS T8OAhDQhgtK23F9SQDS::mfNQ3iBn1u
call System.String T8OAhDQhgtK23F9SQDS::AdlQy3xyPc(System.Int32,T8OAhDQhgtK23F9SQDS)
ldc.i4 624527817
ldc.i4 2099761168
xor <null>
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_85a85229a819430882acc4261c8afa2e
xor <null>
ldsfld T8OAhDQhgtK23F9SQDS T8OAhDQhgtK23F9SQDS::mfNQ3iBn1u
call System.String T8OAhDQhgtK23F9SQDS::AdlQy3xyPc(System.Int32,T8OAhDQhgtK23F9SQDS)
newobj System.Void CJenZtiPcBOiQyVfoO.mA2iBc9M4PFoZistOo::.ctor(System.String,System.String)
newobj System.Void UeH88kNFQrWbN3WDQQU.QReapGNwpAQyPC3uUOx::.ctor(CJenZtiPcBOiQyVfoO.mA2iBc9M4PFoZistOo)
ldloc.s V_0
ldsfld tcVw0PQxXH2cpRxQgcu tcVw0PQxXH2cpRxQgcu::Tg6QzFSl51
call System.Void tcVw0PQxXH2cpRxQgcu::AdlQy3xyPc(System.Object,System.Byte[],tcVw0PQxXH2cpRxQgcu)
ldc.i4 1
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_d194c4042e6a4343a1fb27787cb9028f
brfalse IL_00A0: switch(IL_00C0,IL_013B)
pop <null>
ldc.i4 1
br IL_00A0: switch(IL_00C0,IL_013B)
leave IL_0038: ret
pop <null>
ldc.i4 5
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_f64d74a71a9042679589598546eb08b5
brtrue IL_0172: switch(IL_018E)
pop <null>
ldc.i4 0
br IL_0172: switch(IL_018E)
br IL_016E: ldloc V_3
ldc.i4 0
stloc V_3
ldloc V_3
switch dnlib.DotNet.Emit.Instruction[]
ldloc V_3
ldc.i4 988
beq IL_016E: ldloc V_3
br IL_018E: leave IL_0038
leave IL_0038: ret
ldc.i4 4
ldsfld <Module>{51823506-fe87-468c-875b-205dcea5e3b4} <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_1e974af9b72c48f283363c5b9071918e
ldfld System.Int32 <Module>{51823506-fe87-468c-875b-205dcea5e3b4}::m_e3a41eaa47b646dc9c5ebb5abd317985
brtrue IL_0014: switch(IL_0062,IL_0039,IL_0038)
pop <null>
ldc.i4 2
br IL_0014: switch(IL_0062,IL_0039,IL_0038)
1 malicious · 7 files
EXEeb0da1bf4db13bbb8bc8fbf752274746
Structure
No malware configuration was found at this point.
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙